CVE-2026-44609: Local privilege escalation due to EXE hijacking vulnerability

Synopsis

An EXE hijacking vulnerability in Acronis DeviceLock DLP for Windows allows a local attacker with a low-privilege account to escalate their privileges on the affected host. Exploitation requires the attacker to already have a shell or process on the machine, hold a standard user account, and trick another user into triggering the malicious executable. Successful exploitation gives the attacker full control over confidentiality, integrity, and availability of the affected system. A patched-image rebuild at version 9.0.15051.93227 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network access to the service is required.

• AuthenticationRequired

  Any low-privilege local account is sufficient - no administrative credentials are needed to initiate the attack.

• Victim interactionRequired

  A second user on the system must trigger the hijacked executable, requiring the attacker to socially engineer or otherwise cause that interaction.

• Attack complexityDetail

  Attack complexity is low - the exploit is reliable and does not depend on race conditions, specific memory layouts, or other environmental factors.

Blast Radius

• Reads sensitive files, credentials, or data accessible on the host system.
• Modifies or overwrites files, configurations, and persisted data on the affected machine.
• Crashes, disrupts, or takes full control of the affected service or operating system processes.
• Gains elevated privileges that allow lateral movement or installation of persistent malicious software on the host.